fr Sign in

4.0 Medium

CVE-2026-41990 Libgcrypt before 1.12.2 mishandles Dilithium signing

Description

Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.

Affected products and versions

Product	Affected versions	Fixed in
libgcrypt 1.12	1.12.0 → < 1.12.2	1.12.2

References

lists.gnupg.org lists.gnupg.org
www.openwall.com www.openwall.com
dev.gnupg.org dev.gnupg.org

Timeline

Published April 23, 2026
Last modified April 23, 2026

The 3 CVEs of libgcrypt →

CVE-2026-41989 Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH… 6.7 Medium CVE-2017-7526 libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of… 6.1 Medium

Track this CVE